agenttesla | ad47dd267e28398f802bab88cf1a9c75e9906e2c51eae57d0dcabad47540e700

General

Target

Dhl Parcel.exe
Size

338KB
MD5

9a9edea8487b3aa7f0b92b131a2f100b
SHA1

48e21000745dc66d5614b3a9f246e4fea1d1c8c6
SHA256

ad47dd267e28398f802bab88cf1a9c75e9906e2c51eae57d0dcabad47540e700
SHA512

69d3f7b4a196f2c8f9374e9a868766071ff91021429afba600728d5fc340e25c62d15bce3fab2c3d4953bdde95e4f77c89bb1513945e38b679d948f7db54d2b6

Score

10^/10

agenttesla collection keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot1803146213:AAHYyCRx7FggQ9LfPbrIs79ZUWCEc9wNnDo/sendDocument

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/568-56-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla
behavioral1/memory/568-57-0x000000000040188B-mapping.dmp	family_agenttesla
behavioral1/memory/568-59-0x0000000004470000-0x00000000044A7000-memory.dmp	family_agenttesla
behavioral1/memory/568-61-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla

Loads dropped DLL 1 IoCs

Processes:

Dhl Parcel.exe

pid process

972 Dhl Parcel.exe
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
972	Dhl Parcel.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

Dhl Parcel.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Dhl Parcel.exe
Key opened	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Dhl Parcel.exe
Key opened	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Dhl Parcel.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

Dhl Parcel.exe

description pid process target process

PID 972 set thread context of 568 972 Dhl Parcel.exe Dhl Parcel.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

Dhl Parcel.exe

pid process

568 Dhl Parcel.exe
568 Dhl Parcel.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Dhl Parcel.exe

description pid process

Token: SeDebugPrivilege 568 Dhl Parcel.exe

description	pid	process	target process
PID 972 set thread context of 568	972	Dhl Parcel.exe	Dhl Parcel.exe

pid	process
568	Dhl Parcel.exe
568	Dhl Parcel.exe

description	pid	process
Token: SeDebugPrivilege	568	Dhl Parcel.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

Dhl Parcel.exe

description	pid	process	target process
PID 972 wrote to memory of 568	972	Dhl Parcel.exe	Dhl Parcel.exe
PID 972 wrote to memory of 568	972	Dhl Parcel.exe	Dhl Parcel.exe
PID 972 wrote to memory of 568	972	Dhl Parcel.exe	Dhl Parcel.exe
PID 972 wrote to memory of 568	972	Dhl Parcel.exe	Dhl Parcel.exe
PID 972 wrote to memory of 568	972	Dhl Parcel.exe	Dhl Parcel.exe
PID 972 wrote to memory of 568	972	Dhl Parcel.exe	Dhl Parcel.exe
PID 972 wrote to memory of 568	972	Dhl Parcel.exe	Dhl Parcel.exe
PID 972 wrote to memory of 568	972	Dhl Parcel.exe	Dhl Parcel.exe
PID 972 wrote to memory of 568	972	Dhl Parcel.exe	Dhl Parcel.exe
PID 972 wrote to memory of 568	972	Dhl Parcel.exe	Dhl Parcel.exe
PID 972 wrote to memory of 568	972	Dhl Parcel.exe	Dhl Parcel.exe

outlook_office_path 1 IoCs

Processes:

Dhl Parcel.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Dhl Parcel.exe

outlook_win_path 1 IoCs

Processes:

Dhl Parcel.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Dhl Parcel.exe

C:\Users\Admin\AppData\Local\Temp\Dhl Parcel.exe
"C:\Users\Admin\AppData\Local\Temp\Dhl Parcel.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:972

C:\Users\Admin\AppData\Local\Temp\Dhl Parcel.exe
"C:\Users\Admin\AppData\Local\Temp\Dhl Parcel.exe"
2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:568

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

3

T1005

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsy4857.tmp\zwxoobcdhjo.dll
MD5
35fcf029de669fe8d13f87d2622e4fcb

SHA1
c691acb70efe7d3e34ca90dd4b94ff9b298dddf0

SHA256
c2b18bc2d235c0c178f225678abb67ef702e23663da9a45c82732b5e90d98a9e

SHA512
e8679833f30ce4c1c59afa13f6cae93b8ccf8d2ab954d5de4d3fd54119c90ad52e57f4ed2d944ae9a26062a91cd8aa39a20725e6a3b02b49119c05f6ef4c1cb4

Download Submit
memory/568-56-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/568-57-0x000000000040188B-mapping.dmp

Download
memory/568-59-0x0000000004470000-0x00000000044A7000-memory.dmp

Filesize
220KB

Download
memory/568-62-0x0000000004601000-0x0000000004602000-memory.dmp

Filesize
4KB

Download
memory/568-61-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/568-64-0x0000000004603000-0x0000000004604000-memory.dmp

Filesize
4KB

Download
memory/568-63-0x0000000004602000-0x0000000004603000-memory.dmp

Filesize
4KB

Download
memory/568-65-0x0000000004604000-0x0000000004605000-memory.dmp

Filesize
4KB

Download
memory/972-54-0x0000000076851000-0x0000000076853000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads